Security And Selinux 44.1. Access Control Mechanisms (Acms); Discretionary Access Control (Dac); Access Control Lists (Acls); Mandatory Access Control (Mac) - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

Chapter 44.
Security and SELinux
44.1. Access Control Mechanisms (ACMs)
This section provides a basic introduction to Access Control Mechanisms (ACMs). ACMs provide
a means for system administrators to control which users and processes can access different files,
devices, interfaces, etc., in a computer system. This is a primary consideration when securing a
computer system or network of any size.

44.1.1. Discretionary Access Control (DAC)

Discretionary Access Control (DAC) defines the basic access controls for objects in a filesystem. This
is the typical access control provided by file permissions, sharing, etc. Such access is generally at the
discretion of the owner of the object (file, directory, device, etc.).
DAC provides a means of restricting access to objects based on the identity of the users or groups
(subjects) that try to access those objects. Depending on a subject's access permissions, they may
also be able to pass permissions to other subjects.

44.1.2. Access Control Lists (ACLs)

Access Control Lists (ACLs) provide further control over which objects a subject can access. For more
Chapter 8, Access Control Lists.
information, refer to

44.1.3. Mandatory Access Control (MAC)

Mandatory Access Control (MAC) is a security mechanism that restricts the level of control that users
(subjects) have over the objects that they create. Unlike in a DAC implementation, where users have
full control over their own files, directories, etc., MAC adds additional labels, or categories, to all file
system objects. Users and processes must have the appropriate access to these categories before
they can interact with these objects.
Section 44.2,
In Red Hat Enterprise Linux, MAC is enforced by SELinux. For more information, refer to
"Introduction to SELinux".

44.1.4. Role-based Access Control (RBAC)

Role-based Access Control (RBAC) is an alternative method of controlling user access to file system
objects. Instead of access being controlled by user permissions, the system administrator establishes
Roles based on business functional requirements or similar criteria. These Roles have different types
and levels of access to objects.
In contrast to DAC or MAC systems, where users have access to objects based on their own and the
object's permissions, users in an RBAC system must be members of the appropriate group, or Role,
before they can interact with files, directories, devices, etc.
From an administrative point of view, this makes it easier to control who has access to various parts of
the file system, just by controlling their group memberships.
725